Data controller
John Mingam, independent consultant, Montreal, Quebec, Canada. Contact: privacy@johnmingam.com.
Data collected
Contact form (name, email, company, message), newsletter signup (email), and analytics cookie data if you consent.
Client workspace information
The /app workspace processes account and invitation contact details, organization, roles, verified sites, connection authorizations, imported observations, evidence, reports, recommendations and discussions. Quote requests may include company, contact name, email, telephone and the request. Sessions and sensitive actions generate security logs. These activities support agreed services, access management, requests and workspace protection. Cookies required for sign-in and authorization are not used for advertising.
Access, integrations and AI assistants
John Mingam can access client workspaces to provide services and support. Organization members access data according to their roles. Connected providers supply data authorized by the client; their own terms continue to apply. When a client requests Ask MI and the service is enabled, their question and necessary site observations are sent to OpenAI. An authorized MCP connection lets ChatGPT or Claude obtain data covered by its permissions. These permissions can be revoked; revocation does not delete data already copied to those providers. Do not include secrets or sensitive information in questions or discussions.
MI Signal and crawler observations
These tools collect observations of public pages: URLs, titles, descriptions, links, headings, structured data and change hashes. MI Signal does not collect form contents or keystrokes and does not create a cookie or visitor identifier. Query parameters are removed from URLs, but personal information may remain in a path or public content. Hosting providers may process connection data, including an IP address, to route requests and maintain security. Clients configure the observed pages and must inform visitors to their own sites of the processing performed.
Purposes
Respond to collaboration requests, manage the newsletter, measure site traffic, ensure security and compliance.
Legal basis by jurisdiction
Processing is subject to Quebec’s Act respecting the protection of personal information in the private sector, PIPEDA where applicable and the GDPR where its applicability criteria are met. The basis depends on the jurisdiction and purpose: consent, providing the requested service, contract performance, a legal obligation or another permitted basis. Non-essential cookies are subject to the consent mechanism presented on the site.
Retention period
Leads and contact messages: 3 years from last exchange. Newsletter subscribers: until unsubscribe. Consent logs: 3 years, for evidentiary purposes.
Workspace retention and deletion
Disconnecting a source stops access but preserves previously imported history. A per-site retention setting governs the technical observations to which it applies; it is not a single retention period for accounts, messages, reports and engagement records. Other data are retained according to the service purpose and applicable legal obligations. You can request retention periods for your records, an export, account closure or deletion at privacy@johnmingam.com. Deletion controls in the interface require the appropriate permissions. Any retention obligations and copies held by providers are considered separately; immediate erasure of every backup is not promised.
Recipients
Twenty CRM (contact management), Beehiiv (newsletter), Supabase (authentication and application data), Vercel (hosting and service execution), and integration providers authorized by the client. OpenAI receives necessary questions and observations when Ask MI is requested and enabled; the selected assistant provider receives data requested through an authorized MCP connection. Information is not sold.
Processing outside Quebec
Some providers may process information outside Quebec or Canada depending on their infrastructure and the enabled service, where other laws may apply. Available information about providers and transfers associated with your workspace can be requested at privacy@johnmingam.com. Using these services does not replace the assessments and safeguards required by applicable law.
Do Not Sell or Share My Personal Information
John Mingam does not sell your personal information and does not share it for cross-context behavioral advertising. If such a practice were added, it would be disabled by default for Quebec visitors and subject to a clear choice. To opt out or ask a question, write to privacy@johnmingam.com.
Your rights
You can request access, correction, withdrawal of consent and, where legal conditions are met, deletion, portability or de-indexing of information. Write to privacy@johnmingam.com; requests are handled within applicable legal deadlines, after identity verification if necessary. Withdrawing authorization may prevent the corresponding feature from continuing.
Rights under Quebec's Law 25
As a Quebec resident, you benefit in particular from rights of access, rectification, withdrawal of consent, de-indexing where applicable, and information about the use of your personal information. The person responsible for the protection of personal information is John Mingam, reachable at privacy@johnmingam.com.
Canadian federal framework
Where PIPEDA applies, the site limits collection to necessary information, documents purposes, protects personal information through reasonable safeguards and lets you request access to or correction of your information.
Update notice
The September 11, 2026 version adds processing related to client accounts, teams, integrations, technical observations, Ask MI, MCP access and quote requests. Changes to this policy are communicated through notice appropriate to the affected individuals. New consent is requested where required for a new use or disclosure of information.